1 /* 2 * Redistribution and use in source and binary forms, with or without 3 * modification, are permitted provided that the following conditions 4 * are met: 5 * 1. Redistributions of source code must retain the above copyright 6 * notice immediately at the beginning of the file, without modification, 7 * this list of conditions, and the following disclaimer. 8 * 2. Redistributions in binary form must reproduce the above copyright 9 * notice, this list of conditions and the following disclaimer in the 10 * documentation and/or other materials provided with the distribution. 11 * 12 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND 13 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 14 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 15 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE FOR 16 * ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 17 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 18 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 19 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 20 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 21 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 22 * SUCH DAMAGE. 23 */ 24 /* 25 * libseccomp hooks. 26 */ 27 #include "file.h" 28 29 #ifndef lint 30 FILE_RCSID("@(#)$File: seccomp.c,v 1.25 2022/12/26 18:57:29 christos Exp $") 31 #endif /* lint */ 32 33 #if HAVE_LIBSECCOMP 34 #include <seccomp.h> /* libseccomp */ 35 #include <sys/prctl.h> /* prctl */ 36 #include <sys/ioctl.h> 37 #include <sys/socket.h> 38 #include <termios.h> 39 #include <fcntl.h> 40 #include <stdlib.h> 41 #include <errno.h> 42 43 #define DENY_RULE(call) \ 44 do \ 45 if (seccomp_rule_add (ctx, SCMP_ACT_KILL, SCMP_SYS(call), 0) == -1) \ 46 goto out; \ 47 while (/*CONSTCOND*/0) 48 #define ALLOW_RULE(call) \ 49 do \ 50 if (seccomp_rule_add (ctx, SCMP_ACT_ALLOW, SCMP_SYS(call), 0) == -1) \ 51 goto out; \ 52 while (/*CONSTCOND*/0) 53 54 #define ALLOW_IOCTL_RULE(param) \ 55 do \ 56 if (seccomp_rule_add(ctx, SCMP_ACT_ALLOW, SCMP_SYS(ioctl), 1, \ 57 SCMP_CMP(1, SCMP_CMP_EQ, (scmp_datum_t)param, \ 58 (scmp_datum_t)0)) == -1) \ 59 goto out; \ 60 while (/*CONSTCOND*/0) 61 62 static scmp_filter_ctx ctx; 63 64 int 65 enable_sandbox_basic(void) 66 { 67 68 if (prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0) == -1) 69 return -1; 70 71 if (prctl(PR_SET_DUMPABLE, 0, 0, 0, 0) == -1) 72 return -1; 73 74 // initialize the filter 75 ctx = seccomp_init(SCMP_ACT_ALLOW); 76 if (ctx == NULL) 77 return 1; 78 79 DENY_RULE(_sysctl); 80 DENY_RULE(acct); 81 DENY_RULE(add_key); 82 DENY_RULE(adjtimex); 83 DENY_RULE(chroot); 84 DENY_RULE(clock_adjtime); 85 DENY_RULE(create_module); 86 DENY_RULE(delete_module); 87 DENY_RULE(fanotify_init); 88 DENY_RULE(finit_module); 89 DENY_RULE(get_kernel_syms); 90 DENY_RULE(get_mempolicy); 91 DENY_RULE(init_module); 92 DENY_RULE(io_cancel); 93 DENY_RULE(io_destroy); 94 DENY_RULE(io_getevents); 95 DENY_RULE(io_setup); 96 DENY_RULE(io_submit); 97 DENY_RULE(ioperm); 98 DENY_RULE(iopl); 99 DENY_RULE(ioprio_set); 100 DENY_RULE(kcmp); 101 #ifdef __NR_kexec_file_load 102 DENY_RULE(kexec_file_load); 103 #endif 104 DENY_RULE(kexec_load); 105 DENY_RULE(keyctl); 106 DENY_RULE(lookup_dcookie); 107 DENY_RULE(mbind); 108 DENY_RULE(nfsservctl); 109 DENY_RULE(migrate_pages); 110 DENY_RULE(modify_ldt); 111 DENY_RULE(mount); 112 DENY_RULE(move_pages); 113 DENY_RULE(name_to_handle_at); 114 DENY_RULE(open_by_handle_at); 115 DENY_RULE(perf_event_open); 116 DENY_RULE(pivot_root); 117 DENY_RULE(process_vm_readv); 118 DENY_RULE(process_vm_writev); 119 DENY_RULE(ptrace); 120 DENY_RULE(reboot); 121 DENY_RULE(remap_file_pages); 122 DENY_RULE(request_key); 123 DENY_RULE(set_mempolicy); 124 DENY_RULE(swapoff); 125 DENY_RULE(swapon); 126 DENY_RULE(sysfs); 127 DENY_RULE(syslog); 128 DENY_RULE(tuxcall); 129 DENY_RULE(umount2); 130 DENY_RULE(uselib); 131 DENY_RULE(vmsplice); 132 133 // blocking dangerous syscalls that file should not need 134 DENY_RULE (execve); 135 DENY_RULE (socket); 136 // ... 137 138 139 // applying filter... 140 if (seccomp_load (ctx) == -1) 141 goto out; 142 // free ctx after the filter has been loaded into the kernel 143 seccomp_release(ctx); 144 return 0; 145 146 out: 147 seccomp_release(ctx); 148 return -1; 149 } 150 151 152 int 153 enable_sandbox_full(void) 154 { 155 156 // prevent child processes from getting more priv e.g. via setuid, 157 // capabilities, ... 158 if (prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0) == -1) 159 return -1; 160 161 if (prctl(PR_SET_DUMPABLE, 0, 0, 0, 0) == -1) 162 return -1; 163 164 // initialize the filter 165 ctx = seccomp_init(SCMP_ACT_KILL); 166 if (ctx == NULL) 167 return -1; 168 169 ALLOW_RULE(access); 170 ALLOW_RULE(brk); 171 ALLOW_RULE(close); 172 ALLOW_RULE(dup2); 173 ALLOW_RULE(exit); 174 ALLOW_RULE(exit_group); 175 #ifdef __NR_faccessat 176 ALLOW_RULE(faccessat); 177 #endif 178 ALLOW_RULE(fcntl); 179 ALLOW_RULE(fcntl64); 180 #ifdef __NR_fstat 181 ALLOW_RULE(fstat); 182 #endif 183 ALLOW_RULE(fstat64); 184 #ifdef __NR_fstatat64 185 ALLOW_RULE(fstatat64); 186 #endif 187 ALLOW_RULE(futex); 188 ALLOW_RULE(getdents); 189 #ifdef __NR_getdents64 190 ALLOW_RULE(getdents64); 191 #endif 192 #ifdef FIONREAD 193 // called in src/compress.c under sread 194 ALLOW_IOCTL_RULE(FIONREAD); 195 #endif 196 #ifdef TIOCGWINSZ 197 // musl libc may call ioctl TIOCGWINSZ on stdout 198 ALLOW_IOCTL_RULE(TIOCGWINSZ); 199 #endif 200 #ifdef TCGETS 201 // glibc may call ioctl TCGETS on stdout on physical terminal 202 ALLOW_IOCTL_RULE(TCGETS); 203 #endif 204 ALLOW_RULE(lseek); 205 ALLOW_RULE(_llseek); 206 ALLOW_RULE(lstat); 207 ALLOW_RULE(lstat64); 208 ALLOW_RULE(madvise); 209 ALLOW_RULE(mmap); 210 ALLOW_RULE(mmap2); 211 ALLOW_RULE(mprotect); 212 ALLOW_RULE(mremap); 213 ALLOW_RULE(munmap); 214 #ifdef __NR_newfstatat 215 ALLOW_RULE(newfstatat); 216 #endif 217 ALLOW_RULE(open); 218 ALLOW_RULE(openat); 219 ALLOW_RULE(pread64); 220 ALLOW_RULE(read); 221 ALLOW_RULE(readlink); 222 #ifdef __NR_readlinkat 223 ALLOW_RULE(readlinkat); 224 #endif 225 ALLOW_RULE(rt_sigaction); 226 ALLOW_RULE(rt_sigprocmask); 227 ALLOW_RULE(rt_sigreturn); 228 ALLOW_RULE(select); 229 ALLOW_RULE(stat); 230 ALLOW_RULE(statx); 231 ALLOW_RULE(stat64); 232 ALLOW_RULE(sysinfo); 233 ALLOW_RULE(umask); // Used in file_pipe2file() 234 ALLOW_RULE(getpid); // Used by glibc in file_pipe2file() 235 ALLOW_RULE(unlink); 236 ALLOW_RULE(utimes); 237 ALLOW_RULE(write); 238 ALLOW_RULE(writev); 239 240 241 #if 0 242 // needed by valgrind 243 ALLOW_RULE(gettid); 244 ALLOW_RULE(rt_sigtimedwait); 245 #endif 246 247 #if 0 248 /* special restrictions for socket, only allow AF_UNIX/AF_LOCAL */ 249 if (seccomp_rule_add(ctx, SCMP_ACT_ALLOW, SCMP_SYS(socket), 1, 250 SCMP_CMP(0, SCMP_CMP_EQ, AF_UNIX)) == -1) 251 goto out; 252 253 if (seccomp_rule_add(ctx, SCMP_ACT_ALLOW, SCMP_SYS(socket), 1, 254 SCMP_CMP(0, SCMP_CMP_EQ, AF_LOCAL)) == -1) 255 goto out; 256 257 258 /* special restrictions for open, prevent opening files for writing */ 259 if (seccomp_rule_add(ctx, SCMP_ACT_ALLOW, SCMP_SYS(open), 1, 260 SCMP_CMP(1, SCMP_CMP_MASKED_EQ, O_WRONLY | O_RDWR, 0)) == -1) 261 goto out; 262 263 if (seccomp_rule_add(ctx, SCMP_ACT_ERRNO(EACCES), SCMP_SYS(open), 1, 264 SCMP_CMP(1, SCMP_CMP_MASKED_EQ, O_WRONLY, O_WRONLY)) == -1) 265 goto out; 266 267 if (seccomp_rule_add(ctx, SCMP_ACT_ERRNO(EACCES), SCMP_SYS(open), 1, 268 SCMP_CMP(1, SCMP_CMP_MASKED_EQ, O_RDWR, O_RDWR)) == -1) 269 goto out; 270 271 272 /* allow stderr */ 273 if (seccomp_rule_add(ctx, SCMP_ACT_ALLOW, SCMP_SYS(write), 1, 274 SCMP_CMP(0, SCMP_CMP_EQ, 2)) == -1) 275 goto out; 276 #endif 277 278 // applying filter... 279 if (seccomp_load(ctx) == -1) 280 goto out; 281 // free ctx after the filter has been loaded into the kernel 282 seccomp_release(ctx); 283 return 0; 284 285 out: 286 // something went wrong 287 seccomp_release(ctx); 288 return -1; 289 } 290 #endif 291